Red Hat Lightspeed MCP

(formerly known as Insights MCP)

Red Hat Lightspeed Model Context Protocol (MCP) server is a lightweight, self-hosted solution that connects LLM-based agents - such as Claude Desktop and other MCP-compatible tools - to Red Hat Lightspeed services.

Features

• Supports read-only operations: The server runs in read-only mode by default. Use --all-tools to enable write tools (e.g. create blueprints, run composes). RBAC permissions can also restrict access.
• Provides natural language prompts: provides an ability to use natural language for querying Red Hat Lightspeed services

Supported Lightspeed Services

• advisor
• hosted image builder
• inventory
• planning
• remediations
• vulnerability

Setup and usage

Authentication

Note: Authentication is only required for accessing Red Hat Lightspeed APIs. The MCP server itself does not require authentication.

There are two ways to authenticate:

1. Service Account (client_id + client_secret) — create a service account and provide the credentials via environment variables or HTTP headers.
2. JWT Bearer Token — provide a pre-existing JWT token via the Authorization: Bearer <token> HTTP header (SSE/HTTP transports only).

Service Account Setup

1. Go to https://console.redhat.com → Click Settings (⚙️ Gear Icon) → "Service Accounts"
2. Create a service account and remember Client ID and Client secret for later.
   See below in the integration instructions, there they are respectively referred to as LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET.

Required Permissions by Toolset

Different toolsets require specific roles for your service account:

• Advisor tools: RHEL Advisor viewer, Inventory Hosts viewer
• Inventory tools: Inventory Hosts viewer, Workspace viewer
• Vulnerability tools: Vulnerability viewer, Inventory Hosts viewer
• Remediation tools: Remediations user
• Image Builder tools: Repositories viewer
• RHSM tools: RHC user
• Content Sources tools: Repositories viewer
• Planning tools: Inventory Hosts viewer

These names are Hybrid Cloud Console User Access display names. Do not copy role detail URLs between accounts; they contain tenant-specific identifiers. The consolidated RHEL viewer role can substitute for several of the viewer roles above.

Granting Permissions to Service Accounts

By default, service accounts have no access. An organization administrator must assign permissions. The MCP server will only be able to perform tasks that it has permission to perform. For example, if the user wants to allow read-only operations and deny write operations, this can be accomplished via the permissions system.

For detailed step-by-step instructions, see this video tutorial: Service Account Permissions Setup

1. Log in as Organization Administrator with User Access administrator role

2. Navigate to User Access Settings: Click Settings (⚙️ Gear Icon) → "User Access" → "Groups"

3. Assign permissions (choose one option):

   Option A - Create New Group:

   • Create new group (e.g., mcp-service-accounts)
   • Add required roles (e.g., RHEL Advisor viewer, Inventory Hosts viewer, etc.)
   • Add your service account to this group

   Option B - Use Existing Group:

   • Open existing group with necessary roles
   • Go to "Service accounts" tab
   • Add your service account to the group

Your service account will inherit all roles from the assigned group.

⚠️ Security Remarks ⚠️

If you start this MCP server locally (with podman or docker) make sure the container is not exposed to the internet. In this scenario it's probably fine to use LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET although your MCP Client (e.g. VSCode, Cursor, etc.) can get your LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET.

For a deployment where you connect to this MCP server from a different machine, you should consider that LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET (or your JWT Bearer token) are transferred to the MCP server and you are trusting the remote MCP server not to leak them.

In both cases if you are in doubt, please disable/remove the LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET from your account after you are done using the MCP server.

Security & Incident Response (Emergency Revocation)

To ensure safe AI operations and compliance with security standards, operators must be able to rapidly sever the connected LLM's access to Red Hat Lightspeed in the event of abnormal AI behavior, unexpected data exposure, or suspected token compromise.

Emergency "Kill Switch" Procedure:

If you need to immediately revoke AI access to the toolsets, execute the following steps:

1. Terminate the Server: Stop the MCP container or local process immediately (e.g., run podman ps to find the container, then podman stop <container_id>).
2. Revoke Credentials: Invalidate the Red Hat Client ID used by the MCP server to authenticate with Red Hat services. Go to the "Service Accounts" page and Delete or Reset the credentials.

Additionally you can remove the MCP server entry (e.g., lightspeed-mcp in your client's mcp.json) from your local LLM client's configuration to prevent the client from attempting to restart or reconnect to the server.

If credential compromise or data exposure is suspected, assess breach notification obligations under applicable law (e.g., GDPR). For logging, debug mode, and compliance details, see HACKING.md - Logging and Compliance.

Technical Info

Toolsets

See toolsets.md for the toolsets available in the MCP server.

Integrations

Prerequisites

Make sure you have podman installed.
(Docker is fine too but the commands below have to be adapted accordingly)

You can install it with sudo dnf install podman on Fedora/RHEL/CentOS, or on macOS follow the instructions of Podman Desktop or Podman.

⚠️ Note if you use Podman on macOS, you sometimes need to set the path to podman explicitly. E.g. replace podman with the full path. Should be something like

• /usr/local/bin/podman
• /opt/homebrew/bin/podman
• …

You can find the path by running which podman in your terminal.

Goose Desktop

First check the prerequisites section.

Option 1: One-click installation (easiest)

The badge uses an HTTPS redirect (goose-docs.ai/extension?...) that opens Goose Desktop's extension install flow.

(Note: this uses the quay.io container image and docker as the command — Goose deeplinks only support docker, not podman. Use the manual install below if you rely on Podman.)

After clicking, Goose prompts for LIGHTSPEED_CLIENT_ID and LIGHTSPEED_CLIENT_SECRET, then installs the extension. Start a new chat session to use it.

Option 2: Manual STDIO installation

1. Click the button in the top-left to open the sidebar.
2. Click the Extensions button on the sidebar.
3. Under Extensions, click Add custom extension.
4. On the Add custom extension modal, enter:
   • Type: Standard IO
   • ID: red-hat-lightspeed-mcp
   • Name: Red Hat Lightspeed MCP
   • Description: Red Hat Lightspeed MCP server integration
   • Command: podman run --env LIGHTSPEED_CLIENT_ID --env LIGHTSPEED_CLIENT_SECRET --interactive --rm ghcr.io/redhatinsights/red-hat-lightspeed-mcp:latest
   • Environment variables: click Add for each:
     • LIGHTSPEED_CLIENT_ID — Red Hat Lightspeed Client ID
     • LIGHTSPEED_CLIENT_SECRET — Red Hat Lightspeed Client Secret
   • Timeout: leave default (300s) unless needed
5. Click Add.

Docker users can replace podman with docker in the command. On macOS, if Goose cannot find podman, use the full path from which podman (see prerequisites).

Cursor

First check the prerequisites section.

Option 1: One-click installation (easiest)